Hi. I would like to know if there is an easy way to list Active Directory object permissions, particularly those that might be delegated to users in our Organizational Units (OUs)

We are trying to find out where all one of our groups might be granted specific permissions, and have tried dsacls and other cmd line tools but it is not that easy.

I am certain that this must be a common task for others as well, and thus thought of asking if you could share how you go about making such determinations?

Thanks.